Vulnerability Analysis Results

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_memmove_12.c
  3Label Definition File: CWE121_Stack_Based_Buffer_Overflow__CWE805.label.xml
  4Template File: sources-sink-12.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 121 Stack Based Buffer Overflow
  9 * BadSource:  Set data pointer to the bad buffer
 10 * GoodSource: Set data pointer to the good buffer
 11 * Sink: memmove
 12 *    BadSink : Copy int array to data using memmove
 13 * Flow Variant: 12 Control flow: if(globalReturnsTrueOrFalse())
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#ifndef OMITBAD
 20
 21void CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_memmove_12_bad()
 22{
✓ 23    int * data;
✓ 24    int * dataBadBuffer = (int *)ALLOCA(50*sizeof(int));
✓ 25    int * dataGoodBuffer = (int *)ALLOCA(100*sizeof(int));
✓ 26    if(globalReturnsTrueOrFalse())
 27    {
 28        /* FLAW: Set a pointer to a "small" buffer. This buffer will be used in the sinks as a destination
 29         * buffer in various memory copying functions using a "large" source buffer. */
✓ 30        data = dataBadBuffer;
 31    }
 32    else
 33    {
 34        /* FIX: Set a pointer to a "large" buffer, thus avoiding buffer overflows in the sinks. */
✓ 35        data = dataGoodBuffer;
 36    }
 37    {
✓ 38        int source[100] = {0}; /* fill with 0's */
 39        /* POTENTIAL FLAW: Possible buffer overflow if data < 100 */
✓ 40        memmove(data, source, 100*sizeof(int));❗VULN
✓ 41        printIntLine(data[0]);
 42    }
 43}
 44
 45#endif /* OMITBAD */
 46
 47#ifndef OMITGOOD
 48
 49/* goodG2B() - use goodsource and badsink by changing the "if" so that
 50 * both branches use the GoodSource */
 51static void goodG2B()
 52{
 53    int * data;
 54    int * dataBadBuffer = (int *)ALLOCA(50*sizeof(int));
 55    int * dataGoodBuffer = (int *)ALLOCA(100*sizeof(int));
 56    if(globalReturnsTrueOrFalse())
 57    {
 58        /* FIX: Set a pointer to a "large" buffer, thus avoiding buffer overflows in the sinks. */
 59        data = dataGoodBuffer;
 60    }
 61    else
 62    {
 63        /* FIX: Set a pointer to a "large" buffer, thus avoiding buffer overflows in the sinks. */
 64        data = dataGoodBuffer;
 65    }
 66    {
 67        int source[100] = {0}; /* fill with 0's */
 68        /* POTENTIAL FLAW: Possible buffer overflow if data < 100 */
 69        memmove(data, source, 100*sizeof(int));
 70        printIntLine(data[0]);
 71    }
 72}
 73
 74void CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_memmove_12_good()
 75{
 76    goodG2B();
 77}
 78
 79#endif /* OMITGOOD */
 80
 81/* Below is the main(). It is only used when building this testcase on
 82 * its own for testing or for building a binary to use in testing binary
 83 * analysis tools. It is not used when compiling all the testcases as one
 84 * application, which is how source code analysis tools are tested.
 85 */
 86
 87#ifdef INCLUDEMAIN
 88
 89int main(int argc, char * argv[])
 90{
 91    /* seed randomness */
 92    srand( (unsigned)time(NULL) );
 93#ifndef OMITGOOD
 94    printLine("Calling good()...");
 95    CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_memmove_12_good();
 96    printLine("Finished good()");
 97#endif /* OMITGOOD */
 98#ifndef OMITBAD
 99    printLine("Calling bad()...");
100    CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_memmove_12_bad();
101    printLine("Finished bad()");
102#endif /* OMITBAD */
103    return 0;
104}
105
106#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE122_Heap_Based_Buffer_Overflow__cpp_CWE129_rand_15.cpp
  3Label Definition File: CWE122_Heap_Based_Buffer_Overflow__cpp_CWE129.label.xml
  4Template File: sources-sinks-15.tmpl.cpp
  5*/
  6/*
  7 * @description
  8 * CWE: 122 Heap Based Buffer Overflow
  9 * BadSource: rand Set data to result of rand(), which may be zero
 10 * GoodSource: Larger than zero but less than 10
 11 * Sinks:
 12 *    GoodSink: Ensure the array index is valid
 13 *    BadSink : Improperly check the array index by not checking the upper bound
 14 * Flow Variant: 15 Control flow: switch(6) and switch(7)
 15 * */
 16
 17#include "std_testcase.h"
 18
 19namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE129_rand_15
 20{
 21
 22#ifndef OMITBAD
 23
 24void bad()
 25{
✓ 26    int data;
 27    /* Initialize data */
✓ 28    data = -1;
✓ 29    switch(6)
 30    {
✓ 31    case 6:
 32        /* POTENTIAL FLAW: Set data to a random value */
✓ 33        data = RAND32();
✓ 34        break;
✓ 35    default:
 36        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
✓ 37        printLine("Benign, fixed string");
✓ 38        break;
 39    }
✓ 40    switch(7)
 41    {
✓ 42    case 7:
 43    {
✓ 44        int i;
✓ 45        int * buffer = new int[10];
 46        /* initialize buffer */
✓ 47        for (i = 0; i < 10; i++)
 48        {
✓ 49            buffer[i] = 0;
 50        }
 51        /* POTENTIAL FLAW: Attempt to write to an index of the array that is above the upper bound
 52        * This code does check to see if the array index is negative */
✓ 53        if (data >= 0)
 54        {
✓ 55            buffer[data] = 1;❗VULN
 56            /* Print the array values */
✓ 57            for(i = 0; i < 10; i++)
 58            {
✓ 59                printIntLine(buffer[i]);
 60            }
 61        }
 62        else
 63        {
✓ 64            printLine("ERROR: Array index is negative.");
 65        }
✓ 66        delete[] buffer;
 67    }
✓ 68    break;
✓ 69    default:
 70        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
✓ 71        printLine("Benign, fixed string");
✓ 72        break;
 73    }
 74}
 75
 76#endif /* OMITBAD */
 77
 78#ifndef OMITGOOD
 79
 80/* goodB2G1() - use badsource and goodsink by changing the second switch to switch(8) */
 81static void goodB2G1()
 82{
 83    int data;
 84    /* Initialize data */
 85    data = -1;
 86    switch(6)
 87    {
 88    case 6:
 89        /* POTENTIAL FLAW: Set data to a random value */
 90        data = RAND32();
 91        break;
 92    default:
 93        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 94        printLine("Benign, fixed string");
 95        break;
 96    }
 97    switch(8)
 98    {
 99    case 7:
100        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
101        printLine("Benign, fixed string");
102        break;
103    default:
104    {
105        int i;
106        int * buffer = new int[10];
107        /* initialize buffer */
108        for (i = 0; i < 10; i++)
109        {
110            buffer[i] = 0;
111        }
112        /* FIX: Properly validate the array index and prevent a buffer overflow */
113        if (data >= 0 && data < (10))
114        {
115            buffer[data] = 1;
116            /* Print the array values */
117            for(i = 0; i < 10; i++)
118            {
119                printIntLine(buffer[i]);
120            }
121        }
122        else
123        {
124            printLine("ERROR: Array index is out-of-bounds");
125        }
126        delete[] buffer;
127    }
128    break;
129    }
130}
131
132/* goodB2G2() - use badsource and goodsink by reversing the blocks in the second switch */
133static void goodB2G2()
134{
135    int data;
136    /* Initialize data */
137    data = -1;
138    switch(6)
139    {
140    case 6:
141        /* POTENTIAL FLAW: Set data to a random value */
142        data = RAND32();
143        break;
144    default:
145        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
146        printLine("Benign, fixed string");
147        break;
148    }
149    switch(7)
150    {
151    case 7:
152    {
153        int i;
154        int * buffer = new int[10];
155        /* initialize buffer */
156        for (i = 0; i < 10; i++)
157        {
158            buffer[i] = 0;
159        }
160        /* FIX: Properly validate the array index and prevent a buffer overflow */
161        if (data >= 0 && data < (10))
162        {
163            buffer[data] = 1;
164            /* Print the array values */
165            for(i = 0; i < 10; i++)
166            {
167                printIntLine(buffer[i]);
168            }
169        }
170        else
171        {
172            printLine("ERROR: Array index is out-of-bounds");
173        }
174        delete[] buffer;
175    }
176    break;
177    default:
178        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
179        printLine("Benign, fixed string");
180        break;
181    }
182}
183
184/* goodG2B1() - use goodsource and badsink by changing the first switch to switch(5) */
185static void goodG2B1()
186{
187    int data;
188    /* Initialize data */
189    data = -1;
190    switch(5)
191    {
192    case 6:
193        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
194        printLine("Benign, fixed string");
195        break;
196    default:
197        /* FIX: Use a value greater than 0, but less than 10 to avoid attempting to
198         * access an index of the array in the sink that is out-of-bounds */
199        data = 7;
200        break;
201    }
202    switch(7)
203    {
204    case 7:
205    {
206        int i;
207        int * buffer = new int[10];
208        /* initialize buffer */
209        for (i = 0; i < 10; i++)
210        {
211            buffer[i] = 0;
212        }
213        /* POTENTIAL FLAW: Attempt to write to an index of the array that is above the upper bound
214        * This code does check to see if the array index is negative */
215        if (data >= 0)
216        {
217            buffer[data] = 1;
218            /* Print the array values */
219            for(i = 0; i < 10; i++)
220            {
221                printIntLine(buffer[i]);
222            }
223        }
224        else
225        {
226            printLine("ERROR: Array index is negative.");
227        }
228        delete[] buffer;
229    }
230    break;
231    default:
232        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
233        printLine("Benign, fixed string");
234        break;
235    }
236}
237
238/* goodG2B2() - use goodsource and badsink by reversing the blocks in the first switch */
239static void goodG2B2()
240{
241    int data;
242    /* Initialize data */
243    data = -1;
244    switch(6)
245    {
246    case 6:
247        /* FIX: Use a value greater than 0, but less than 10 to avoid attempting to
248         * access an index of the array in the sink that is out-of-bounds */
249        data = 7;
250        break;
251    default:
252        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
253        printLine("Benign, fixed string");
254        break;
255    }
256    switch(7)
257    {
258    case 7:
259    {
260        int i;
261        int * buffer = new int[10];
262        /* initialize buffer */
263        for (i = 0; i < 10; i++)
264        {
265            buffer[i] = 0;
266        }
267        /* POTENTIAL FLAW: Attempt to write to an index of the array that is above the upper bound
268        * This code does check to see if the array index is negative */
269        if (data >= 0)
270        {
271            buffer[data] = 1;
272            /* Print the array values */
273            for(i = 0; i < 10; i++)
274            {
275                printIntLine(buffer[i]);
276            }
277        }
278        else
279        {
280            printLine("ERROR: Array index is negative.");
281        }
282        delete[] buffer;
283    }
284    break;
285    default:
286        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
287        printLine("Benign, fixed string");
288        break;
289    }
290}
291
292void good()
293{
294    goodB2G1();
295    goodB2G2();
296    goodG2B1();
297    goodG2B2();
298}
299
300#endif /* OMITGOOD */
301
302} /* close namespace */
303
304/* Below is the main(). It is only used when building this testcase on
305   its own for testing or for building a binary to use in testing binary
306   analysis tools. It is not used when compiling all the testcases as one
307   application, which is how source code analysis tools are tested. */
308
309#ifdef INCLUDEMAIN
310
311using namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE129_rand_15; /* so that we can use good and bad easily */
312
313int main(int argc, char * argv[])
314{
315    /* seed randomness */
316    srand( (unsigned)time(NULL) );
317#ifndef OMITGOOD
318    printLine("Calling good()...");
319    good();
320    printLine("Finished good()");
321#endif /* OMITGOOD */
322#ifndef OMITBAD
323    printLine("Calling bad()...");
324    bad();
325    printLine("Finished bad()");
326#endif /* OMITBAD */
327    return 0;
328}
329
330#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_ncpy_07.cpp
  3Label Definition File: CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805.string.label.xml
  4Template File: sources-sink-07.tmpl.cpp
  5*/
  6/*
  7 * @description
  8 * CWE: 122 Heap Based Buffer Overflow
  9 * BadSource:  Allocate using new[] and set data pointer to a small buffer
 10 * GoodSource: Allocate using new[] and set data pointer to a large buffer
 11 * Sink: ncpy
 12 *    BadSink : Copy string to data using wcsncpy
 13 * Flow Variant: 07 Control flow: if(staticFive==5) and if(staticFive!=5)
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21/* The variable below is not declared "const", but is never assigned
 22   any other value so a tool should be able to identify that reads of
 23   this will always give its initialized value. */
 24static int staticFive = 5;
 25
 26namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_ncpy_07
 27{
 28
 29#ifndef OMITBAD
 30
 31void bad()
 32{
✓ 33    wchar_t * data;
✓ 34    data = NULL;
✓ 35    if(staticFive==5)
 36    {
 37        /* FLAW: Allocate using new[] and point data to a small buffer that is smaller than the large buffer used in the sinks */
✓ 38        data = new wchar_t[50];
✓ 39        data[0] = L'\0'; /* null terminate */
 40    }
 41    {
✓ 42        wchar_t source[100];
✓ 43        wmemset(source, L'C', 100-1); /* fill with L'C's */
✓ 44        source[100-1] = L'\0'; /* null terminate */
 45        /* POTENTIAL FLAW: Possible buffer overflow if source is larger than data */
✓ 46        wcsncpy(data, source, 100-1);❗VULN
✓ 47        data[100-1] = L'\0'; /* Ensure the destination buffer is null terminated */
✓ 48        printWLine(data);
✓ 49        delete [] data;
 50    }
 51}
 52
 53#endif /* OMITBAD */
 54
 55#ifndef OMITGOOD
 56
 57/* goodG2B1() - use goodsource and badsink by changing the staticFive==5 to staticFive!=5 */
 58static void goodG2B1()
 59{
 60    wchar_t * data;
 61    data = NULL;
 62    if(staticFive!=5)
 63    {
 64        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 65        printLine("Benign, fixed string");
 66    }
 67    else
 68    {
 69        /* FIX: Allocate using new[] and point data to a large buffer that is at least as large as the large buffer used in the sink */
 70        data = new wchar_t[100];
 71        data[0] = L'\0'; /* null terminate */
 72    }
 73    {
 74        wchar_t source[100];
 75        wmemset(source, L'C', 100-1); /* fill with L'C's */
 76        source[100-1] = L'\0'; /* null terminate */
 77        /* POTENTIAL FLAW: Possible buffer overflow if source is larger than data */
 78        wcsncpy(data, source, 100-1);
 79        data[100-1] = L'\0'; /* Ensure the destination buffer is null terminated */
 80        printWLine(data);
 81        delete [] data;
 82    }
 83}
 84
 85/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if statement */
 86static void goodG2B2()
 87{
 88    wchar_t * data;
 89    data = NULL;
 90    if(staticFive==5)
 91    {
 92        /* FIX: Allocate using new[] and point data to a large buffer that is at least as large as the large buffer used in the sink */
 93        data = new wchar_t[100];
 94        data[0] = L'\0'; /* null terminate */
 95    }
 96    {
 97        wchar_t source[100];
 98        wmemset(source, L'C', 100-1); /* fill with L'C's */
 99        source[100-1] = L'\0'; /* null terminate */
100        /* POTENTIAL FLAW: Possible buffer overflow if source is larger than data */
101        wcsncpy(data, source, 100-1);
102        data[100-1] = L'\0'; /* Ensure the destination buffer is null terminated */
103        printWLine(data);
104        delete [] data;
105    }
106}
107
108void good()
109{
110    goodG2B1();
111    goodG2B2();
112}
113
114#endif /* OMITGOOD */
115
116} /* close namespace */
117
118/* Below is the main(). It is only used when building this testcase on
119   its own for testing or for building a binary to use in testing binary
120   analysis tools. It is not used when compiling all the testcases as one
121   application, which is how source code analysis tools are tested. */
122
123#ifdef INCLUDEMAIN
124
125using namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_ncpy_07; /* so that we can use good and bad easily */
126
127int main(int argc, char * argv[])
128{
129    /* seed randomness */
130    srand( (unsigned)time(NULL) );
131#ifndef OMITGOOD
132    printLine("Calling good()...");
133    good();
134    printLine("Finished good()");
135#endif /* OMITGOOD */
136#ifndef OMITBAD
137    printLine("Calling bad()...");
138    bad();
139    printLine("Finished bad()");
140#endif /* OMITBAD */
141    return 0;
142}
143
144#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE122_Heap_Based_Buffer_Overflow__cpp_src_char_cpy_07.cpp
  3Label Definition File: CWE122_Heap_Based_Buffer_Overflow__cpp_src.label.xml
  4Template File: sources-sink-07.tmpl.cpp
  5*/
  6/*
  7 * @description
  8 * CWE: 122 Heap Based Buffer Overflow
  9 * BadSource:  Initialize data as a large string
 10 * GoodSource: Initialize data as a small string
 11 * Sink: cpy
 12 *    BadSink : Copy data to string using strcpy
 13 * Flow Variant: 07 Control flow: if(staticFive==5) and if(staticFive!=5)
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21/* The variable below is not declared "const", but is never assigned
 22   any other value so a tool should be able to identify that reads of
 23   this will always give its initialized value. */
 24static int staticFive = 5;
 25
 26namespace CWE122_Heap_Based_Buffer_Overflow__cpp_src_char_cpy_07
 27{
 28
 29#ifndef OMITBAD
 30
 31void bad()
 32{
✓ 33    char * data;
✓ 34    data = new char[100];
✓ 35    if(staticFive==5)
 36    {
 37        /* FLAW: Initialize data as a large buffer that is larger than the small buffer used in the sink */
✓ 38        memset(data, 'A', 100-1); /* fill with 'A's */
✓ 39        data[100-1] = '\0'; /* null terminate */
 40    }
 41    {
✓ 42        char dest[50] = "";
 43        /* POTENTIAL FLAW: Possible buffer overflow if data is larger than dest */
✓ 44        strcpy(dest, data);❗VULN
✓ 45        printLine(data);
✓ 46        delete [] data;
 47    }
 48}
 49
 50#endif /* OMITBAD */
 51
 52#ifndef OMITGOOD
 53
 54/* goodG2B1() - use goodsource and badsink by changing the staticFive==5 to staticFive!=5 */
 55static void goodG2B1()
 56{
 57    char * data;
 58    data = new char[100];
 59    if(staticFive!=5)
 60    {
 61        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 62        printLine("Benign, fixed string");
 63    }
 64    else
 65    {
 66        /* FIX: Initialize data as a small buffer that as small or smaller than the small buffer used in the sink */
 67        memset(data, 'A', 50-1); /* fill with 'A's */
 68        data[50-1] = '\0'; /* null terminate */
 69    }
 70    {
 71        char dest[50] = "";
 72        /* POTENTIAL FLAW: Possible buffer overflow if data is larger than dest */
 73        strcpy(dest, data);
 74        printLine(data);
 75        delete [] data;
 76    }
 77}
 78
 79/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if statement */
 80static void goodG2B2()
 81{
 82    char * data;
 83    data = new char[100];
 84    if(staticFive==5)
 85    {
 86        /* FIX: Initialize data as a small buffer that as small or smaller than the small buffer used in the sink */
 87        memset(data, 'A', 50-1); /* fill with 'A's */
 88        data[50-1] = '\0'; /* null terminate */
 89    }
 90    {
 91        char dest[50] = "";
 92        /* POTENTIAL FLAW: Possible buffer overflow if data is larger than dest */
 93        strcpy(dest, data);
 94        printLine(data);
 95        delete [] data;
 96    }
 97}
 98
 99void good()
100{
101    goodG2B1();
102    goodG2B2();
103}
104
105#endif /* OMITGOOD */
106
107} /* close namespace */
108
109/* Below is the main(). It is only used when building this testcase on
110   its own for testing or for building a binary to use in testing binary
111   analysis tools. It is not used when compiling all the testcases as one
112   application, which is how source code analysis tools are tested. */
113
114#ifdef INCLUDEMAIN
115
116using namespace CWE122_Heap_Based_Buffer_Overflow__cpp_src_char_cpy_07; /* so that we can use good and bad easily */
117
118int main(int argc, char * argv[])
119{
120    /* seed randomness */
121    srand( (unsigned)time(NULL) );
122#ifndef OMITGOOD
123    printLine("Calling good()...");
124    good();
125    printLine("Finished good()");
126#endif /* OMITGOOD */
127#ifndef OMITBAD
128    printLine("Calling bad()...");
129    bad();
130    printLine("Finished bad()");
131#endif /* OMITBAD */
132    return 0;
133}
134
135#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE127_Buffer_Underread__char_declare_loop_10.c
  3Label Definition File: CWE127_Buffer_Underread.stack.label.xml
  4Template File: sources-sink-10.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 127 Buffer Under-read
  9 * BadSource:  Set data pointer to before the allocated memory buffer
 10 * GoodSource: Set data pointer to the allocated memory buffer
 11 * Sink: loop
 12 *    BadSink : Copy data to string using a loop
 13 * Flow Variant: 10 Control flow: if(globalTrue) and if(globalFalse)
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21#ifndef OMITBAD
 22
 23void CWE127_Buffer_Underread__char_declare_loop_10_bad()
 24{
✓ 25    char * data;
✓ 26    char dataBuffer[100];
✓ 27    memset(dataBuffer, 'A', 100-1);
✓ 28    dataBuffer[100-1] = '\0';
✓ 29    if(globalTrue)
 30    {
 31        /* FLAW: Set data pointer to before the allocated memory buffer */
✓ 32        data = dataBuffer - 8;
 33    }
 34    {
✓ 35        size_t i;
✓ 36        char dest[100];
✓ 37        memset(dest, 'C', 100-1); /* fill with 'C's */
✓ 38        dest[100-1] = '\0'; /* null terminate */
 39        /* POTENTIAL FLAW: Possibly copy from a memory location located before the source buffer */
✓ 40        for (i = 0; i < 100; i++)
 41        {
✓ 42            dest[i] = data[i];❗VULN
 43        }
 44        /* Ensure null termination */
✓ 45        dest[100-1] = '\0';
✓ 46        printLine(dest);
 47    }
 48}
 49
 50#endif /* OMITBAD */
 51
 52#ifndef OMITGOOD
 53
 54/* goodG2B1() - use goodsource and badsink by changing the globalTrue to globalFalse */
 55static void goodG2B1()
 56{
 57    char * data;
 58    char dataBuffer[100];
 59    memset(dataBuffer, 'A', 100-1);
 60    dataBuffer[100-1] = '\0';
 61    if(globalFalse)
 62    {
 63        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 64        printLine("Benign, fixed string");
 65    }
 66    else
 67    {
 68        /* FIX: Set data pointer to the allocated memory buffer */
 69        data = dataBuffer;
 70    }
 71    {
 72        size_t i;
 73        char dest[100];
 74        memset(dest, 'C', 100-1); /* fill with 'C's */
 75        dest[100-1] = '\0'; /* null terminate */
 76        /* POTENTIAL FLAW: Possibly copy from a memory location located before the source buffer */
 77        for (i = 0; i < 100; i++)
 78        {
 79            dest[i] = data[i];
 80        }
 81        /* Ensure null termination */
 82        dest[100-1] = '\0';
 83        printLine(dest);
 84    }
 85}
 86
 87/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if statement */
 88static void goodG2B2()
 89{
 90    char * data;
 91    char dataBuffer[100];
 92    memset(dataBuffer, 'A', 100-1);
 93    dataBuffer[100-1] = '\0';
 94    if(globalTrue)
 95    {
 96        /* FIX: Set data pointer to the allocated memory buffer */
 97        data = dataBuffer;
 98    }
 99    {
100        size_t i;
101        char dest[100];
102        memset(dest, 'C', 100-1); /* fill with 'C's */
103        dest[100-1] = '\0'; /* null terminate */
104        /* POTENTIAL FLAW: Possibly copy from a memory location located before the source buffer */
105        for (i = 0; i < 100; i++)
106        {
107            dest[i] = data[i];
108        }
109        /* Ensure null termination */
110        dest[100-1] = '\0';
111        printLine(dest);
112    }
113}
114
115void CWE127_Buffer_Underread__char_declare_loop_10_good()
116{
117    goodG2B1();
118    goodG2B2();
119}
120
121#endif /* OMITGOOD */
122
123/* Below is the main(). It is only used when building this testcase on
124 * its own for testing or for building a binary to use in testing binary
125 * analysis tools. It is not used when compiling all the testcases as one
126 * application, which is how source code analysis tools are tested.
127 */
128
129#ifdef INCLUDEMAIN
130
131int main(int argc, char * argv[])
132{
133    /* seed randomness */
134    srand( (unsigned)time(NULL) );
135#ifndef OMITGOOD
136    printLine("Calling good()...");
137    CWE127_Buffer_Underread__char_declare_loop_10_good();
138    printLine("Finished good()");
139#endif /* OMITGOOD */
140#ifndef OMITBAD
141    printLine("Calling bad()...");
142    CWE127_Buffer_Underread__char_declare_loop_10_bad();
143    printLine("Finished bad()");
144#endif /* OMITBAD */
145    return 0;
146}
147
148#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE127_Buffer_Underread__malloc_char_cpy_12.c
  3Label Definition File: CWE127_Buffer_Underread__malloc.label.xml
  4Template File: sources-sink-12.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 127 Buffer Under-read
  9 * BadSource:  Set data pointer to before the allocated memory buffer
 10 * GoodSource: Set data pointer to the allocated memory buffer
 11 * Sink: cpy
 12 *    BadSink : Copy data to string using strcpy
 13 * Flow Variant: 12 Control flow: if(globalReturnsTrueOrFalse())
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21#ifndef OMITBAD
 22
 23void CWE127_Buffer_Underread__malloc_char_cpy_12_bad()
 24{
✓ 25    char * data;
✓ 26    data = NULL;
✓ 27    if(globalReturnsTrueOrFalse())
 28    {
 29        {
✓ 30            char * dataBuffer = (char *)malloc(100*sizeof(char));
✓ 31            if (dataBuffer == NULL) {exit(-1);}
✓ 32            memset(dataBuffer, 'A', 100-1);
✓ 33            dataBuffer[100-1] = '\0';
 34            /* FLAW: Set data pointer to before the allocated memory buffer */
✓ 35            data = dataBuffer - 8;
 36        }
 37    }
 38    else
 39    {
 40        {
✓ 41            char * dataBuffer = (char *)malloc(100*sizeof(char));
✓ 42            if (dataBuffer == NULL) {exit(-1);}
✓ 43            memset(dataBuffer, 'A', 100-1);
✓ 44            dataBuffer[100-1] = '\0';
 45            /* FIX: Set data pointer to the allocated memory buffer */
✓ 46            data = dataBuffer;
 47        }
 48    }
 49    {
✓ 50        char dest[100*2];
✓ 51        memset(dest, 'C', 100*2-1); /* fill with 'C's */
✓ 52        dest[100*2-1] = '\0'; /* null terminate */
 53        /* POTENTIAL FLAW: Possibly copy from a memory location located before the source buffer */
✓ 54        strcpy(dest, data);❗VULN
✓ 55        printLine(dest);
 56        /* INCIDENTAL CWE-401: Memory Leak - data may not point to location
 57         * returned by malloc() so can't safely call free() on it */
 58    }
 59}
 60
 61#endif /* OMITBAD */
 62
 63#ifndef OMITGOOD
 64
 65/* goodG2B() - use goodsource and badsink by changing the "if" so that
 66 * both branches use the GoodSource */
 67static void goodG2B()
 68{
 69    char * data;
 70    data = NULL;
 71    if(globalReturnsTrueOrFalse())
 72    {
 73        {
 74            char * dataBuffer = (char *)malloc(100*sizeof(char));
 75            if (dataBuffer == NULL) {exit(-1);}
 76            memset(dataBuffer, 'A', 100-1);
 77            dataBuffer[100-1] = '\0';
 78            /* FIX: Set data pointer to the allocated memory buffer */
 79            data = dataBuffer;
 80        }
 81    }
 82    else
 83    {
 84        {
 85            char * dataBuffer = (char *)malloc(100*sizeof(char));
 86            if (dataBuffer == NULL) {exit(-1);}
 87            memset(dataBuffer, 'A', 100-1);
 88            dataBuffer[100-1] = '\0';
 89            /* FIX: Set data pointer to the allocated memory buffer */
 90            data = dataBuffer;
 91        }
 92    }
 93    {
 94        char dest[100*2];
 95        memset(dest, 'C', 100*2-1); /* fill with 'C's */
 96        dest[100*2-1] = '\0'; /* null terminate */
 97        /* POTENTIAL FLAW: Possibly copy from a memory location located before the source buffer */
 98        strcpy(dest, data);
 99        printLine(dest);
100        /* INCIDENTAL CWE-401: Memory Leak - data may not point to location
101         * returned by malloc() so can't safely call free() on it */
102    }
103}
104
105void CWE127_Buffer_Underread__malloc_char_cpy_12_good()
106{
107    goodG2B();
108}
109
110#endif /* OMITGOOD */
111
112/* Below is the main(). It is only used when building this testcase on
113 * its own for testing or for building a binary to use in testing binary
114 * analysis tools. It is not used when compiling all the testcases as one
115 * application, which is how source code analysis tools are tested.
116 */
117
118#ifdef INCLUDEMAIN
119
120int main(int argc, char * argv[])
121{
122    /* seed randomness */
123    srand( (unsigned)time(NULL) );
124#ifndef OMITGOOD
125    printLine("Calling good()...");
126    CWE127_Buffer_Underread__malloc_char_cpy_12_good();
127    printLine("Finished good()");
128#endif /* OMITGOOD */
129#ifndef OMITBAD
130    printLine("Calling bad()...");
131    CWE127_Buffer_Underread__malloc_char_cpy_12_bad();
132    printLine("Finished bad()");
133#endif /* OMITBAD */
134    return 0;
135}
136
137#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE122_Heap_Based_Buffer_Overflow__CWE131_loop_14.c
  3Label Definition File: CWE122_Heap_Based_Buffer_Overflow__CWE131.label.xml
  4Template File: sources-sink-14.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 122 Heap Based Buffer Overflow
  9 * BadSource:  Allocate memory without using sizeof(int)
 10 * GoodSource: Allocate memory using sizeof(int)
 11 * Sink: loop
 12 *    BadSink : Copy array to data using a loop
 13 * Flow Variant: 14 Control flow: if(globalFive==5) and if(globalFive!=5)
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#ifndef OMITBAD
 20
 21void CWE122_Heap_Based_Buffer_Overflow__CWE131_loop_14_bad()
 22{
✓ 23    int * data;
✓ 24    data = NULL;
✓ 25    if(globalFive==5)
 26    {
 27        /* FLAW: Allocate memory without using sizeof(int) */
✓ 28        data = (int *)malloc(10);
✓ 29        if (data == NULL) {exit(-1);}
 30    }
 31    {
✓ 32        int source[10] = {0};
✓ 33        size_t i;
 34        /* POTENTIAL FLAW: Possible buffer overflow if data was not allocated correctly in the source */
✓ 35        for (i = 0; i < 10; i++)
 36        {
✓ 37            data[i] = source[i];❗VULN
 38        }
✓ 39        printIntLine(data[0]);
✓ 40        free(data);
 41    }
 42}
 43
 44#endif /* OMITBAD */
 45
 46#ifndef OMITGOOD
 47
 48/* goodG2B1() - use goodsource and badsink by changing the globalFive==5 to globalFive!=5 */
 49static void goodG2B1()
 50{
 51    int * data;
 52    data = NULL;
 53    if(globalFive!=5)
 54    {
 55        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 56        printLine("Benign, fixed string");
 57    }
 58    else
 59    {
 60        /* FIX: Allocate memory using sizeof(int) */
 61        data = (int *)malloc(10*sizeof(int));
 62        if (data == NULL) {exit(-1);}
 63    }
 64    {
 65        int source[10] = {0};
 66        size_t i;
 67        /* POTENTIAL FLAW: Possible buffer overflow if data was not allocated correctly in the source */
 68        for (i = 0; i < 10; i++)
 69        {
 70            data[i] = source[i];
 71        }
 72        printIntLine(data[0]);
 73        free(data);
 74    }
 75}
 76
 77/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if statement */
 78static void goodG2B2()
 79{
 80    int * data;
 81    data = NULL;
 82    if(globalFive==5)
 83    {
 84        /* FIX: Allocate memory using sizeof(int) */
 85        data = (int *)malloc(10*sizeof(int));
 86        if (data == NULL) {exit(-1);}
 87    }
 88    {
 89        int source[10] = {0};
 90        size_t i;
 91        /* POTENTIAL FLAW: Possible buffer overflow if data was not allocated correctly in the source */
 92        for (i = 0; i < 10; i++)
 93        {
 94            data[i] = source[i];
 95        }
 96        printIntLine(data[0]);
 97        free(data);
 98    }
 99}
100
101void CWE122_Heap_Based_Buffer_Overflow__CWE131_loop_14_good()
102{
103    goodG2B1();
104    goodG2B2();
105}
106
107#endif /* OMITGOOD */
108
109/* Below is the main(). It is only used when building this testcase on
110 * its own for testing or for building a binary to use in testing binary
111 * analysis tools. It is not used when compiling all the testcases as one
112 * application, which is how source code analysis tools are tested.
113 */
114
115#ifdef INCLUDEMAIN
116
117int main(int argc, char * argv[])
118{
119    /* seed randomness */
120    srand( (unsigned)time(NULL) );
121#ifndef OMITGOOD
122    printLine("Calling good()...");
123    CWE122_Heap_Based_Buffer_Overflow__CWE131_loop_14_good();
124    printLine("Finished good()");
125#endif /* OMITGOOD */
126#ifndef OMITBAD
127    printLine("Calling bad()...");
128    CWE122_Heap_Based_Buffer_Overflow__CWE131_loop_14_bad();
129    printLine("Finished bad()");
130#endif /* OMITBAD */
131    return 0;
132}
133
134#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE122_Heap_Based_Buffer_Overflow__cpp_src_char_cpy_13.cpp
  3Label Definition File: CWE122_Heap_Based_Buffer_Overflow__cpp_src.label.xml
  4Template File: sources-sink-13.tmpl.cpp
  5*/
  6/*
  7 * @description
  8 * CWE: 122 Heap Based Buffer Overflow
  9 * BadSource:  Initialize data as a large string
 10 * GoodSource: Initialize data as a small string
 11 * Sink: cpy
 12 *    BadSink : Copy data to string using strcpy
 13 * Flow Variant: 13 Control flow: if(GLOBAL_CONST_FIVE==5) and if(GLOBAL_CONST_FIVE!=5)
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21namespace CWE122_Heap_Based_Buffer_Overflow__cpp_src_char_cpy_13
 22{
 23
 24#ifndef OMITBAD
 25
 26void bad()
 27{
✓ 28    char * data;
✓ 29    data = new char[100];
✓ 30    if(GLOBAL_CONST_FIVE==5)
 31    {
 32        /* FLAW: Initialize data as a large buffer that is larger than the small buffer used in the sink */
✓ 33        memset(data, 'A', 100-1); /* fill with 'A's */
✓ 34        data[100-1] = '\0'; /* null terminate */
 35    }
 36    {
✓ 37        char dest[50] = "";
 38        /* POTENTIAL FLAW: Possible buffer overflow if data is larger than dest */
✓ 39        strcpy(dest, data);❗VULN
✓ 40        printLine(data);
✓ 41        delete [] data;
 42    }
 43}
 44
 45#endif /* OMITBAD */
 46
 47#ifndef OMITGOOD
 48
 49/* goodG2B1() - use goodsource and badsink by changing the GLOBAL_CONST_FIVE==5 to GLOBAL_CONST_FIVE!=5 */
 50static void goodG2B1()
 51{
 52    char * data;
 53    data = new char[100];
 54    if(GLOBAL_CONST_FIVE!=5)
 55    {
 56        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 57        printLine("Benign, fixed string");
 58    }
 59    else
 60    {
 61        /* FIX: Initialize data as a small buffer that as small or smaller than the small buffer used in the sink */
 62        memset(data, 'A', 50-1); /* fill with 'A's */
 63        data[50-1] = '\0'; /* null terminate */
 64    }
 65    {
 66        char dest[50] = "";
 67        /* POTENTIAL FLAW: Possible buffer overflow if data is larger than dest */
 68        strcpy(dest, data);
 69        printLine(data);
 70        delete [] data;
 71    }
 72}
 73
 74/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if statement */
 75static void goodG2B2()
 76{
 77    char * data;
 78    data = new char[100];
 79    if(GLOBAL_CONST_FIVE==5)
 80    {
 81        /* FIX: Initialize data as a small buffer that as small or smaller than the small buffer used in the sink */
 82        memset(data, 'A', 50-1); /* fill with 'A's */
 83        data[50-1] = '\0'; /* null terminate */
 84    }
 85    {
 86        char dest[50] = "";
 87        /* POTENTIAL FLAW: Possible buffer overflow if data is larger than dest */
 88        strcpy(dest, data);
 89        printLine(data);
 90        delete [] data;
 91    }
 92}
 93
 94void good()
 95{
 96    goodG2B1();
 97    goodG2B2();
 98}
 99
100#endif /* OMITGOOD */
101
102} /* close namespace */
103
104/* Below is the main(). It is only used when building this testcase on
105   its own for testing or for building a binary to use in testing binary
106   analysis tools. It is not used when compiling all the testcases as one
107   application, which is how source code analysis tools are tested. */
108
109#ifdef INCLUDEMAIN
110
111using namespace CWE122_Heap_Based_Buffer_Overflow__cpp_src_char_cpy_13; /* so that we can use good and bad easily */
112
113int main(int argc, char * argv[])
114{
115    /* seed randomness */
116    srand( (unsigned)time(NULL) );
117#ifndef OMITGOOD
118    printLine("Calling good()...");
119    good();
120    printLine("Finished good()");
121#endif /* OMITGOOD */
122#ifndef OMITBAD
123    printLine("Calling bad()...");
124    bad();
125    printLine("Finished bad()");
126#endif /* OMITBAD */
127    return 0;
128}
129
130#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE121_Stack_Based_Buffer_Overflow__CWE805_char_declare_loop_12.c
  3Label Definition File: CWE121_Stack_Based_Buffer_Overflow__CWE805.string.label.xml
  4Template File: sources-sink-12.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 121 Stack Based Buffer Overflow
  9 * BadSource:  Set data pointer to the bad buffer
 10 * GoodSource: Set data pointer to the good buffer
 11 * Sink: loop
 12 *    BadSink : Copy string to data using a loop
 13 * Flow Variant: 12 Control flow: if(globalReturnsTrueOrFalse())
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21#ifndef OMITBAD
 22
 23void CWE121_Stack_Based_Buffer_Overflow__CWE805_char_declare_loop_12_bad()
 24{
✓ 25    char * data;
✓ 26    char dataBadBuffer[50];
✓ 27    char dataGoodBuffer[100];
✓ 28    if(globalReturnsTrueOrFalse())
 29    {
 30        /* FLAW: Set a pointer to a "small" buffer. This buffer will be used in the sinks as a destination
 31         * buffer in various memory copying functions using a "large" source buffer. */
✓ 32        data = dataBadBuffer;
✓ 33        data[0] = '\0'; /* null terminate */
 34    }
 35    else
 36    {
 37        /* FIX: Set a pointer to a "large" buffer, thus avoiding buffer overflows in the sinks. */
✓ 38        data = dataGoodBuffer;
✓ 39        data[0] = '\0'; /* null terminate */
 40    }
 41    {
✓ 42        size_t i;
✓ 43        char source[100];
✓ 44        memset(source, 'C', 100-1); /* fill with 'C's */
✓ 45        source[100-1] = '\0'; /* null terminate */
 46        /* POTENTIAL FLAW: Possible buffer overflow if the size of data is less than the length of source */
✓ 47        for (i = 0; i < 100; i++)
 48        {
✓ 49            data[i] = source[i];❗VULN
 50        }
✓ 51        data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */
✓ 52        printLine(data);
 53    }
 54}
 55
 56#endif /* OMITBAD */
 57
 58#ifndef OMITGOOD
 59
 60/* goodG2B() - use goodsource and badsink by changing the "if" so that
 61 * both branches use the GoodSource */
 62static void goodG2B()
 63{
 64    char * data;
 65    char dataBadBuffer[50];
 66    char dataGoodBuffer[100];
 67    if(globalReturnsTrueOrFalse())
 68    {
 69        /* FIX: Set a pointer to a "large" buffer, thus avoiding buffer overflows in the sinks. */
 70        data = dataGoodBuffer;
 71        data[0] = '\0'; /* null terminate */
 72    }
 73    else
 74    {
 75        /* FIX: Set a pointer to a "large" buffer, thus avoiding buffer overflows in the sinks. */
 76        data = dataGoodBuffer;
 77        data[0] = '\0'; /* null terminate */
 78    }
 79    {
 80        size_t i;
 81        char source[100];
 82        memset(source, 'C', 100-1); /* fill with 'C's */
 83        source[100-1] = '\0'; /* null terminate */
 84        /* POTENTIAL FLAW: Possible buffer overflow if the size of data is less than the length of source */
 85        for (i = 0; i < 100; i++)
 86        {
 87            data[i] = source[i];
 88        }
 89        data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */
 90        printLine(data);
 91    }
 92}
 93
 94void CWE121_Stack_Based_Buffer_Overflow__CWE805_char_declare_loop_12_good()
 95{
 96    goodG2B();
 97}
 98
 99#endif /* OMITGOOD */
100
101/* Below is the main(). It is only used when building this testcase on
102 * its own for testing or for building a binary to use in testing binary
103 * analysis tools. It is not used when compiling all the testcases as one
104 * application, which is how source code analysis tools are tested.
105 */
106
107#ifdef INCLUDEMAIN
108
109int main(int argc, char * argv[])
110{
111    /* seed randomness */
112    srand( (unsigned)time(NULL) );
113#ifndef OMITGOOD
114    printLine("Calling good()...");
115    CWE121_Stack_Based_Buffer_Overflow__CWE805_char_declare_loop_12_good();
116    printLine("Finished good()");
117#endif /* OMITGOOD */
118#ifndef OMITBAD
119    printLine("Calling bad()...");
120    CWE121_Stack_Based_Buffer_Overflow__CWE805_char_declare_loop_12_bad();
121    printLine("Finished bad()");
122#endif /* OMITBAD */
123    return 0;
124}
125
126#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE127_Buffer_Underread__wchar_t_declare_memmove_13.c
  3Label Definition File: CWE127_Buffer_Underread.stack.label.xml
  4Template File: sources-sink-13.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 127 Buffer Under-read
  9 * BadSource:  Set data pointer to before the allocated memory buffer
 10 * GoodSource: Set data pointer to the allocated memory buffer
 11 * Sink: memmove
 12 *    BadSink : Copy data to string using memmove
 13 * Flow Variant: 13 Control flow: if(GLOBAL_CONST_FIVE==5) and if(GLOBAL_CONST_FIVE!=5)
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21#ifndef OMITBAD
 22
 23void CWE127_Buffer_Underread__wchar_t_declare_memmove_13_bad()
 24{
✓ 25    wchar_t * data;
✓ 26    wchar_t dataBuffer[100];
✓ 27    wmemset(dataBuffer, L'A', 100-1);
✓ 28    dataBuffer[100-1] = L'\0';
✓ 29    if(GLOBAL_CONST_FIVE==5)
 30    {
 31        /* FLAW: Set data pointer to before the allocated memory buffer */
✓ 32        data = dataBuffer - 8;
 33    }
 34    {
✓ 35        wchar_t dest[100];
✓ 36        wmemset(dest, L'C', 100-1); /* fill with 'C's */
✓ 37        dest[100-1] = L'\0'; /* null terminate */
 38        /* POTENTIAL FLAW: Possibly copy from a memory location located before the source buffer */
✓ 39        memmove(dest, data, 100*sizeof(wchar_t));❗VULN
 40        /* Ensure null termination */
✓ 41        dest[100-1] = L'\0';
✓ 42        printWLine(dest);
 43    }
 44}
 45
 46#endif /* OMITBAD */
 47
 48#ifndef OMITGOOD
 49
 50/* goodG2B1() - use goodsource and badsink by changing the GLOBAL_CONST_FIVE==5 to GLOBAL_CONST_FIVE!=5 */
 51static void goodG2B1()
 52{
 53    wchar_t * data;
 54    wchar_t dataBuffer[100];
 55    wmemset(dataBuffer, L'A', 100-1);
 56    dataBuffer[100-1] = L'\0';
 57    if(GLOBAL_CONST_FIVE!=5)
 58    {
 59        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 60        printLine("Benign, fixed string");
 61    }
 62    else
 63    {
 64        /* FIX: Set data pointer to the allocated memory buffer */
 65        data = dataBuffer;
 66    }
 67    {
 68        wchar_t dest[100];
 69        wmemset(dest, L'C', 100-1); /* fill with 'C's */
 70        dest[100-1] = L'\0'; /* null terminate */
 71        /* POTENTIAL FLAW: Possibly copy from a memory location located before the source buffer */
 72        memmove(dest, data, 100*sizeof(wchar_t));
 73        /* Ensure null termination */
 74        dest[100-1] = L'\0';
 75        printWLine(dest);
 76    }
 77}
 78
 79/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if statement */
 80static void goodG2B2()
 81{
 82    wchar_t * data;
 83    wchar_t dataBuffer[100];
 84    wmemset(dataBuffer, L'A', 100-1);
 85    dataBuffer[100-1] = L'\0';
 86    if(GLOBAL_CONST_FIVE==5)
 87    {
 88        /* FIX: Set data pointer to the allocated memory buffer */
 89        data = dataBuffer;
 90    }
 91    {
 92        wchar_t dest[100];
 93        wmemset(dest, L'C', 100-1); /* fill with 'C's */
 94        dest[100-1] = L'\0'; /* null terminate */
 95        /* POTENTIAL FLAW: Possibly copy from a memory location located before the source buffer */
 96        memmove(dest, data, 100*sizeof(wchar_t));
 97        /* Ensure null termination */
 98        dest[100-1] = L'\0';
 99        printWLine(dest);
100    }
101}
102
103void CWE127_Buffer_Underread__wchar_t_declare_memmove_13_good()
104{
105    goodG2B1();
106    goodG2B2();
107}
108
109#endif /* OMITGOOD */
110
111/* Below is the main(). It is only used when building this testcase on
112 * its own for testing or for building a binary to use in testing binary
113 * analysis tools. It is not used when compiling all the testcases as one
114 * application, which is how source code analysis tools are tested.
115 */
116
117#ifdef INCLUDEMAIN
118
119int main(int argc, char * argv[])
120{
121    /* seed randomness */
122    srand( (unsigned)time(NULL) );
123#ifndef OMITGOOD
124    printLine("Calling good()...");
125    CWE127_Buffer_Underread__wchar_t_declare_memmove_13_good();
126    printLine("Finished good()");
127#endif /* OMITGOOD */
128#ifndef OMITBAD
129    printLine("Calling bad()...");
130    CWE127_Buffer_Underread__wchar_t_declare_memmove_13_bad();
131    printLine("Finished bad()");
132#endif /* OMITBAD */
133    return 0;
134}
135
136#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE121_Stack_Based_Buffer_Overflow__CWE805_char_alloca_ncpy_18.c
  3Label Definition File: CWE121_Stack_Based_Buffer_Overflow__CWE805.string.label.xml
  4Template File: sources-sink-18.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 121 Stack Based Buffer Overflow
  9 * BadSource:  Set data pointer to the bad buffer
 10 * GoodSource: Set data pointer to the good buffer
 11 * Sink: ncpy
 12 *    BadSink : Copy string to data using strncpy
 13 * Flow Variant: 18 Control flow: goto statements
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21#ifndef OMITBAD
 22
 23void CWE121_Stack_Based_Buffer_Overflow__CWE805_char_alloca_ncpy_18_bad()
 24{
✓ 25    char * data;
✓ 26    char * dataBadBuffer = (char *)ALLOCA(50*sizeof(char));
✓ 27    char * dataGoodBuffer = (char *)ALLOCA(100*sizeof(char));
✓ 28    goto source;
✓ 29source:
 30    /* FLAW: Set a pointer to a "small" buffer. This buffer will be used in the sinks as a destination
 31     * buffer in various memory copying functions using a "large" source buffer. */
✓ 32    data = dataBadBuffer;
✓ 33    data[0] = '\0'; /* null terminate */
 34    {
✓ 35        char source[100];
✓ 36        memset(source, 'C', 100-1); /* fill with 'C's */
✓ 37        source[100-1] = '\0'; /* null terminate */
 38        /* POTENTIAL FLAW: Possible buffer overflow if the size of data is less than the length of source */
✓ 39        strncpy(data, source, 100-1);❗VULN
✓ 40        data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */
✓ 41        printLine(data);
 42    }
 43}
 44
 45#endif /* OMITBAD */
 46
 47#ifndef OMITGOOD
 48
 49/* goodG2B() - use goodsource and badsink by reversing the blocks on the goto statement */
 50static void goodG2B()
 51{
 52    char * data;
 53    char * dataBadBuffer = (char *)ALLOCA(50*sizeof(char));
 54    char * dataGoodBuffer = (char *)ALLOCA(100*sizeof(char));
 55    goto source;
 56source:
 57    /* FIX: Set a pointer to a "large" buffer, thus avoiding buffer overflows in the sinks. */
 58    data = dataGoodBuffer;
 59    data[0] = '\0'; /* null terminate */
 60    {
 61        char source[100];
 62        memset(source, 'C', 100-1); /* fill with 'C's */
 63        source[100-1] = '\0'; /* null terminate */
 64        /* POTENTIAL FLAW: Possible buffer overflow if the size of data is less than the length of source */
 65        strncpy(data, source, 100-1);
 66        data[100-1] = '\0'; /* Ensure the destination buffer is null terminated */
 67        printLine(data);
 68    }
 69}
 70
 71void CWE121_Stack_Based_Buffer_Overflow__CWE805_char_alloca_ncpy_18_good()
 72{
 73    goodG2B();
 74}
 75
 76#endif /* OMITGOOD */
 77
 78/* Below is the main(). It is only used when building this testcase on
 79 * its own for testing or for building a binary to use in testing binary
 80 * analysis tools. It is not used when compiling all the testcases as one
 81 * application, which is how source code analysis tools are tested.
 82 */
 83
 84#ifdef INCLUDEMAIN
 85
 86int main(int argc, char * argv[])
 87{
 88    /* seed randomness */
 89    srand( (unsigned)time(NULL) );
 90#ifndef OMITGOOD
 91    printLine("Calling good()...");
 92    CWE121_Stack_Based_Buffer_Overflow__CWE805_char_alloca_ncpy_18_good();
 93    printLine("Finished good()");
 94#endif /* OMITGOOD */
 95#ifndef OMITBAD
 96    printLine("Calling bad()...");
 97    CWE121_Stack_Based_Buffer_Overflow__CWE805_char_alloca_ncpy_18_bad();
 98    printLine("Finished bad()");
 99#endif /* OMITBAD */
100    return 0;
101}
102
103#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_loop_32.c
  3Label Definition File: CWE121_Stack_Based_Buffer_Overflow__CWE805.label.xml
  4Template File: sources-sink-32.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 121 Stack Based Buffer Overflow
  9 * BadSource:  Set data pointer to the bad buffer
 10 * GoodSource: Set data pointer to the good buffer
 11 * Sink: loop
 12 *    BadSink : Copy int array to data using a loop
 13 * Flow Variant: 32 Data flow using two pointers to the same value within the same function
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#ifndef OMITBAD
 20
 21void CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_loop_32_bad()
 22{
✓ 23    int * data;
✓ 24    int * *dataPtr1 = &data;
✓ 25    int * *dataPtr2 = &data;
✓ 26    int * dataBadBuffer = (int *)ALLOCA(50*sizeof(int));
✓ 27    int * dataGoodBuffer = (int *)ALLOCA(100*sizeof(int));
 28    {
✓ 29        int * data = *dataPtr1;
 30        /* FLAW: Set a pointer to a "small" buffer. This buffer will be used in the sinks as a destination
 31         * buffer in various memory copying functions using a "large" source buffer. */
✓ 32        data = dataBadBuffer;
✓ 33        *dataPtr1 = data;
 34    }
 35    {
✓ 36        int * data = *dataPtr2;
 37        {
✓ 38            int source[100] = {0}; /* fill with 0's */
 39            {
✓ 40                size_t i;
 41                /* POTENTIAL FLAW: Possible buffer overflow if data < 100 */
✓ 42                for (i = 0; i < 100; i++)
 43                {
✓ 44                    data[i] = source[i];❗VULN
 45                }
✓ 46                printIntLine(data[0]);
 47            }
 48        }
 49    }
 50}
 51
 52#endif /* OMITBAD */
 53
 54#ifndef OMITGOOD
 55
 56/* goodG2B() uses the GoodSource with the BadSink */
 57static void goodG2B()
 58{
 59    int * data;
 60    int * *dataPtr1 = &data;
 61    int * *dataPtr2 = &data;
 62    int * dataBadBuffer = (int *)ALLOCA(50*sizeof(int));
 63    int * dataGoodBuffer = (int *)ALLOCA(100*sizeof(int));
 64    {
 65        int * data = *dataPtr1;
 66        /* FIX: Set a pointer to a "large" buffer, thus avoiding buffer overflows in the sinks. */
 67        data = dataGoodBuffer;
 68        *dataPtr1 = data;
 69    }
 70    {
 71        int * data = *dataPtr2;
 72        {
 73            int source[100] = {0}; /* fill with 0's */
 74            {
 75                size_t i;
 76                /* POTENTIAL FLAW: Possible buffer overflow if data < 100 */
 77                for (i = 0; i < 100; i++)
 78                {
 79                    data[i] = source[i];
 80                }
 81                printIntLine(data[0]);
 82            }
 83        }
 84    }
 85}
 86
 87void CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_loop_32_good()
 88{
 89    goodG2B();
 90}
 91
 92#endif /* OMITGOOD */
 93
 94/* Below is the main(). It is only used when building this testcase on
 95 * its own for testing or for building a binary to use in testing binary
 96 * analysis tools. It is not used when compiling all the testcases as one
 97 * application, which is how source code analysis tools are tested.
 98 */
 99#ifdef INCLUDEMAIN
100
101int main(int argc, char * argv[])
102{
103    /* seed randomness */
104    srand( (unsigned)time(NULL) );
105#ifndef OMITGOOD
106    printLine("Calling good()...");
107    CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_loop_32_good();
108    printLine("Finished good()");
109#endif /* OMITGOOD */
110#ifndef OMITBAD
111    printLine("Calling bad()...");
112    CWE121_Stack_Based_Buffer_Overflow__CWE805_int_alloca_loop_32_bad();
113    printLine("Finished bad()");
114#endif /* OMITBAD */
115    return 0;
116}
117
118#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE121_Stack_Based_Buffer_Overflow__CWE805_wchar_t_declare_ncpy_68b.c
  3Label Definition File: CWE121_Stack_Based_Buffer_Overflow__CWE805.string.label.xml
  4Template File: sources-sink-68b.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 121 Stack Based Buffer Overflow
  9 * BadSource:  Set data pointer to the bad buffer
 10 * GoodSource: Set data pointer to the good buffer
 11 * Sink: ncpy
 12 *    BadSink : Copy string to data using wcsncpy
 13 * Flow Variant: 68 Data flow: data passed as a global variable from one function to another in different source files
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21extern wchar_t * CWE121_Stack_Based_Buffer_Overflow__CWE805_wchar_t_declare_ncpy_68_badData;
 22extern wchar_t * CWE121_Stack_Based_Buffer_Overflow__CWE805_wchar_t_declare_ncpy_68_goodG2BData;
 23
 24/* all the sinks are the same, we just want to know where the hit originated if a tool flags one */
 25
 26#ifndef OMITBAD
 27
 28void CWE121_Stack_Based_Buffer_Overflow__CWE805_wchar_t_declare_ncpy_68b_badSink()
 29{
✓ 30    wchar_t * data = CWE121_Stack_Based_Buffer_Overflow__CWE805_wchar_t_declare_ncpy_68_badData;
 31    {
✓ 32        wchar_t source[100];
✓ 33        wmemset(source, L'C', 100-1); /* fill with L'C's */
✓ 34        source[100-1] = L'\0'; /* null terminate */
 35        /* POTENTIAL FLAW: Possible buffer overflow if the size of data is less than the length of source */
✓ 36        wcsncpy(data, source, 100-1);❗VULN
✓ 37        data[100-1] = L'\0'; /* Ensure the destination buffer is null terminated */
✓ 38        printWLine(data);
 39    }
 40}
 41
 42#endif /* OMITBAD */
 43
 44#ifndef OMITGOOD
 45
 46/* goodG2B uses the GoodSource with the BadSink */
 47void CWE121_Stack_Based_Buffer_Overflow__CWE805_wchar_t_declare_ncpy_68b_goodG2BSink()
 48{
 49    wchar_t * data = CWE121_Stack_Based_Buffer_Overflow__CWE805_wchar_t_declare_ncpy_68_goodG2BData;
 50    {
 51        wchar_t source[100];
 52        wmemset(source, L'C', 100-1); /* fill with L'C's */
 53        source[100-1] = L'\0'; /* null terminate */
 54        /* POTENTIAL FLAW: Possible buffer overflow if the size of data is less than the length of source */
 55        wcsncpy(data, source, 100-1);
 56        data[100-1] = L'\0'; /* Ensure the destination buffer is null terminated */
 57        printWLine(data);
 58    }
 59}
 60
 61#endif /* OMITGOOD */

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE124_Buffer_Underwrite__char_declare_memcpy_09.c
  3Label Definition File: CWE124_Buffer_Underwrite.stack.label.xml
  4Template File: sources-sink-09.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 124 Buffer Underwrite
  9 * BadSource:  Set data pointer to before the allocated memory buffer
 10 * GoodSource: Set data pointer to the allocated memory buffer
 11 * Sink: memcpy
 12 *    BadSink : Copy string to data using memcpy
 13 * Flow Variant: 09 Control flow: if(GLOBAL_CONST_TRUE) and if(GLOBAL_CONST_FALSE)
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21#ifndef OMITBAD
 22
 23void CWE124_Buffer_Underwrite__char_declare_memcpy_09_bad()
 24{
✓ 25    char * data;
✓ 26    char dataBuffer[100];
✓ 27    memset(dataBuffer, 'A', 100-1);
✓ 28    dataBuffer[100-1] = '\0';
✓ 29    if(GLOBAL_CONST_TRUE)
 30    {
 31        /* FLAW: Set data pointer to before the allocated memory buffer */
✓ 32        data = dataBuffer - 8;
 33    }
 34    {
✓ 35        char source[100];
✓ 36        memset(source, 'C', 100-1); /* fill with 'C's */
✓ 37        source[100-1] = '\0'; /* null terminate */
 38        /* POTENTIAL FLAW: Possibly copying data to memory before the destination buffer */
✓ 39        memcpy(data, source, 100*sizeof(char));❗VULN
 40        /* Ensure the destination buffer is null terminated */
✓ 41        data[100-1] = '\0';
✓ 42        printLine(data);
 43    }
 44}
 45
 46#endif /* OMITBAD */
 47
 48#ifndef OMITGOOD
 49
 50/* goodG2B1() - use goodsource and badsink by changing the GLOBAL_CONST_TRUE to GLOBAL_CONST_FALSE */
 51static void goodG2B1()
 52{
 53    char * data;
 54    char dataBuffer[100];
 55    memset(dataBuffer, 'A', 100-1);
 56    dataBuffer[100-1] = '\0';
 57    if(GLOBAL_CONST_FALSE)
 58    {
 59        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 60        printLine("Benign, fixed string");
 61    }
 62    else
 63    {
 64        /* FIX: Set data pointer to the allocated memory buffer */
 65        data = dataBuffer;
 66    }
 67    {
 68        char source[100];
 69        memset(source, 'C', 100-1); /* fill with 'C's */
 70        source[100-1] = '\0'; /* null terminate */
 71        /* POTENTIAL FLAW: Possibly copying data to memory before the destination buffer */
 72        memcpy(data, source, 100*sizeof(char));
 73        /* Ensure the destination buffer is null terminated */
 74        data[100-1] = '\0';
 75        printLine(data);
 76    }
 77}
 78
 79/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if statement */
 80static void goodG2B2()
 81{
 82    char * data;
 83    char dataBuffer[100];
 84    memset(dataBuffer, 'A', 100-1);
 85    dataBuffer[100-1] = '\0';
 86    if(GLOBAL_CONST_TRUE)
 87    {
 88        /* FIX: Set data pointer to the allocated memory buffer */
 89        data = dataBuffer;
 90    }
 91    {
 92        char source[100];
 93        memset(source, 'C', 100-1); /* fill with 'C's */
 94        source[100-1] = '\0'; /* null terminate */
 95        /* POTENTIAL FLAW: Possibly copying data to memory before the destination buffer */
 96        memcpy(data, source, 100*sizeof(char));
 97        /* Ensure the destination buffer is null terminated */
 98        data[100-1] = '\0';
 99        printLine(data);
100    }
101}
102
103void CWE124_Buffer_Underwrite__char_declare_memcpy_09_good()
104{
105    goodG2B1();
106    goodG2B2();
107}
108
109#endif /* OMITGOOD */
110
111/* Below is the main(). It is only used when building this testcase on
112 * its own for testing or for building a binary to use in testing binary
113 * analysis tools. It is not used when compiling all the testcases as one
114 * application, which is how source code analysis tools are tested.
115 */
116
117#ifdef INCLUDEMAIN
118
119int main(int argc, char * argv[])
120{
121    /* seed randomness */
122    srand( (unsigned)time(NULL) );
123#ifndef OMITGOOD
124    printLine("Calling good()...");
125    CWE124_Buffer_Underwrite__char_declare_memcpy_09_good();
126    printLine("Finished good()");
127#endif /* OMITGOOD */
128#ifndef OMITBAD
129    printLine("Calling bad()...");
130    CWE124_Buffer_Underwrite__char_declare_memcpy_09_bad();
131    printLine("Finished bad()");
132#endif /* OMITBAD */
133    return 0;
134}
135
136#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE122_Heap_Based_Buffer_Overflow__c_CWE805_int_memmove_14.c
  3Label Definition File: CWE122_Heap_Based_Buffer_Overflow__c_CWE805.label.xml
  4Template File: sources-sink-14.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 122 Heap Based Buffer Overflow
  9 * BadSource:  Allocate using malloc() and set data pointer to a small buffer
 10 * GoodSource: Allocate using malloc() and set data pointer to a large buffer
 11 * Sink: memmove
 12 *    BadSink : Copy int array to data using memmove
 13 * Flow Variant: 14 Control flow: if(globalFive==5) and if(globalFive!=5)
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#ifndef OMITBAD
 20
 21void CWE122_Heap_Based_Buffer_Overflow__c_CWE805_int_memmove_14_bad()
 22{
✓ 23    int * data;
✓ 24    data = NULL;
✓ 25    if(globalFive==5)
 26    {
 27        /* FLAW: Allocate and point data to a small buffer that is smaller than the large buffer used in the sinks */
✓ 28        data = (int *)malloc(50*sizeof(int));
✓ 29        if (data == NULL) {exit(-1);}
 30    }
 31    {
✓ 32        int source[100] = {0}; /* fill with 0's */
 33        /* POTENTIAL FLAW: Possible buffer overflow if data < 100 */
✓ 34        memmove(data, source, 100*sizeof(int));❗VULN
✓ 35        printIntLine(data[0]);
✓ 36        free(data);
 37    }
 38}
 39
 40#endif /* OMITBAD */
 41
 42#ifndef OMITGOOD
 43
 44/* goodG2B1() - use goodsource and badsink by changing the globalFive==5 to globalFive!=5 */
 45static void goodG2B1()
 46{
 47    int * data;
 48    data = NULL;
 49    if(globalFive!=5)
 50    {
 51        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 52        printLine("Benign, fixed string");
 53    }
 54    else
 55    {
 56        /* FIX: Allocate and point data to a large buffer that is at least as large as the large buffer used in the sink */
 57        data = (int *)malloc(100*sizeof(int));
 58        if (data == NULL) {exit(-1);}
 59    }
 60    {
 61        int source[100] = {0}; /* fill with 0's */
 62        /* POTENTIAL FLAW: Possible buffer overflow if data < 100 */
 63        memmove(data, source, 100*sizeof(int));
 64        printIntLine(data[0]);
 65        free(data);
 66    }
 67}
 68
 69/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if statement */
 70static void goodG2B2()
 71{
 72    int * data;
 73    data = NULL;
 74    if(globalFive==5)
 75    {
 76        /* FIX: Allocate and point data to a large buffer that is at least as large as the large buffer used in the sink */
 77        data = (int *)malloc(100*sizeof(int));
 78        if (data == NULL) {exit(-1);}
 79    }
 80    {
 81        int source[100] = {0}; /* fill with 0's */
 82        /* POTENTIAL FLAW: Possible buffer overflow if data < 100 */
 83        memmove(data, source, 100*sizeof(int));
 84        printIntLine(data[0]);
 85        free(data);
 86    }
 87}
 88
 89void CWE122_Heap_Based_Buffer_Overflow__c_CWE805_int_memmove_14_good()
 90{
 91    goodG2B1();
 92    goodG2B2();
 93}
 94
 95#endif /* OMITGOOD */
 96
 97/* Below is the main(). It is only used when building this testcase on
 98 * its own for testing or for building a binary to use in testing binary
 99 * analysis tools. It is not used when compiling all the testcases as one
100 * application, which is how source code analysis tools are tested.
101 */
102
103#ifdef INCLUDEMAIN
104
105int main(int argc, char * argv[])
106{
107    /* seed randomness */
108    srand( (unsigned)time(NULL) );
109#ifndef OMITGOOD
110    printLine("Calling good()...");
111    CWE122_Heap_Based_Buffer_Overflow__c_CWE805_int_memmove_14_good();
112    printLine("Finished good()");
113#endif /* OMITGOOD */
114#ifndef OMITBAD
115    printLine("Calling bad()...");
116    CWE122_Heap_Based_Buffer_Overflow__c_CWE805_int_memmove_14_bad();
117    printLine("Finished bad()");
118#endif /* OMITBAD */
119    return 0;
120}
121
122#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE126_Buffer_Overread__malloc_char_memcpy_01.c
  3Label Definition File: CWE126_Buffer_Overread__malloc.label.xml
  4Template File: sources-sink-01.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 126 Buffer Over-read
  9 * BadSource:  Use a small buffer
 10 * GoodSource: Use a large buffer
 11 * Sink: memcpy
 12 *    BadSink : Copy data to string using memcpy
 13 * Flow Variant: 01 Baseline
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21#ifndef OMITBAD
 22
 23void CWE126_Buffer_Overread__malloc_char_memcpy_01_bad()
 24{
✓ 25    char * data;
✓ 26    data = NULL;
 27    /* FLAW: Use a small buffer */
✓ 28    data = (char *)malloc(50*sizeof(char));
✓ 29    if (data == NULL) {exit(-1);}
✓ 30    memset(data, 'A', 50-1); /* fill with 'A's */
✓ 31    data[50-1] = '\0'; /* null terminate */
 32    {
✓ 33        char dest[100];
✓ 34        memset(dest, 'C', 100-1);
✓ 35        dest[100-1] = '\0'; /* null terminate */
 36        /* POTENTIAL FLAW: using memcpy with the length of the dest where data
 37         * could be smaller than dest causing buffer overread */
✓ 38        memcpy(dest, data, strlen(dest)*sizeof(char));❗VULN
✓ 39        dest[100-1] = '\0';
✓ 40        printLine(dest);
✓ 41        free(data);
 42    }
 43}
 44
 45#endif /* OMITBAD */
 46
 47#ifndef OMITGOOD
 48
 49/* goodG2B uses the GoodSource with the BadSink */
 50static void goodG2B()
 51{
 52    char * data;
 53    data = NULL;
 54    /* FIX: Use a large buffer */
 55    data = (char *)malloc(100*sizeof(char));
 56    if (data == NULL) {exit(-1);}
 57    memset(data, 'A', 100-1); /* fill with 'A's */
 58    data[100-1] = '\0'; /* null terminate */
 59    {
 60        char dest[100];
 61        memset(dest, 'C', 100-1);
 62        dest[100-1] = '\0'; /* null terminate */
 63        /* POTENTIAL FLAW: using memcpy with the length of the dest where data
 64         * could be smaller than dest causing buffer overread */
 65        memcpy(dest, data, strlen(dest)*sizeof(char));
 66        dest[100-1] = '\0';
 67        printLine(dest);
 68        free(data);
 69    }
 70}
 71
 72void CWE126_Buffer_Overread__malloc_char_memcpy_01_good()
 73{
 74    goodG2B();
 75}
 76
 77#endif /* OMITGOOD */
 78
 79/* Below is the main(). It is only used when building this testcase on
 80 * its own for testing or for building a binary to use in testing binary
 81 * analysis tools. It is not used when compiling all the testcases as one
 82 * application, which is how source code analysis tools are tested.
 83 */
 84
 85#ifdef INCLUDEMAIN
 86
 87int main(int argc, char * argv[])
 88{
 89    /* seed randomness */
 90    srand( (unsigned)time(NULL) );
 91#ifndef OMITGOOD
 92    printLine("Calling good()...");
 93    CWE126_Buffer_Overread__malloc_char_memcpy_01_good();
 94    printLine("Finished good()");
 95#endif /* OMITGOOD */
 96#ifndef OMITBAD
 97    printLine("Calling bad()...");
 98    CWE126_Buffer_Overread__malloc_char_memcpy_01_bad();
 99    printLine("Finished bad()");
100#endif /* OMITBAD */
101    return 0;
102}
103
104#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22a.c
  3Label Definition File: CWE122_Heap_Based_Buffer_Overflow__c_CWE806.label.xml
  4Template File: sources-sink-22a.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 122 Heap Based Buffer Overflow
  9 * BadSource:  Initialize data as a large string
 10 * GoodSource: Initialize data as a small string
 11 * Sink: ncat
 12 *    BadSink : Copy data to string using strncat
 13 * Flow Variant: 22 Control flow: Flow controlled by value of a global variable. Sink functions are in a separate file from sources.
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#include <wchar.h>
 20
 21#ifndef OMITBAD
 22
 23/* The global variable below is used to drive control flow in the source function */
 24int CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_badGlobal = 0;
 25
 26char * CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_badSource(char * data);
 27
 28void CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_bad()
 29{
✓ 30    char * data;
✓ 31    data = (char *)malloc(100*sizeof(char));
✓ 32    if (data == NULL) {exit(-1);}
✓ 33    CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_badGlobal = 1; /* true */
✓ 34    data = CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_badSource(data);
 35    {
✓ 36        char dest[50] = "";
 37        /* POTENTIAL FLAW: Possible buffer overflow if data is larger than sizeof(dest)-strlen(dest)*/
✓ 38        strncat(dest, data, strlen(data));❗VULN
✓ 39        dest[50-1] = '\0'; /* Ensure the destination buffer is null terminated */
✓ 40        printLine(data);
✓ 41        free(data);
 42    }
 43}
 44
 45#endif /* OMITBAD */
 46
 47#ifndef OMITGOOD
 48
 49/* The global variables below are used to drive control flow in the source functions. */
 50int CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_goodG2B1Global = 0;
 51int CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_goodG2B2Global = 0;
 52
 53/* goodG2B1() - use goodsource and badsink by setting the static variable to false instead of true */
 54char * CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_goodG2B1Source(char * data);
 55
 56static void goodG2B1()
 57{
 58    char * data;
 59    data = (char *)malloc(100*sizeof(char));
 60    if (data == NULL) {exit(-1);}
 61    CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_goodG2B1Global = 0; /* false */
 62    data = CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_goodG2B1Source(data);
 63    {
 64        char dest[50] = "";
 65        /* POTENTIAL FLAW: Possible buffer overflow if data is larger than sizeof(dest)-strlen(dest)*/
 66        strncat(dest, data, strlen(data));
 67        dest[50-1] = '\0'; /* Ensure the destination buffer is null terminated */
 68        printLine(data);
 69        free(data);
 70    }
 71}
 72
 73/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if in the source function */
 74char * CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_goodG2B2Source(char * data);
 75
 76static void goodG2B2()
 77{
 78    char * data;
 79    data = (char *)malloc(100*sizeof(char));
 80    if (data == NULL) {exit(-1);}
 81    CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_goodG2B2Global = 1; /* true */
 82    data = CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_goodG2B2Source(data);
 83    {
 84        char dest[50] = "";
 85        /* POTENTIAL FLAW: Possible buffer overflow if data is larger than sizeof(dest)-strlen(dest)*/
 86        strncat(dest, data, strlen(data));
 87        dest[50-1] = '\0'; /* Ensure the destination buffer is null terminated */
 88        printLine(data);
 89        free(data);
 90    }
 91}
 92
 93void CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_good()
 94{
 95    goodG2B1();
 96    goodG2B2();
 97}
 98
 99#endif /* OMITGOOD */
100
101/* Below is the main(). It is only used when building this testcase on
102 * its own for testing or for building a binary to use in testing binary
103 * analysis tools. It is not used when compiling all the testcases as one
104 * application, which is how source code analysis tools are tested.
105 */
106
107#ifdef INCLUDEMAIN
108
109int main(int argc, char * argv[])
110{
111    /* seed randomness */
112    srand( (unsigned)time(NULL) );
113#ifndef OMITGOOD
114    printLine("Calling good()...");
115    CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_good();
116    printLine("Finished good()");
117#endif /* OMITGOOD */
118#ifndef OMITBAD
119    printLine("Calling bad()...");
120    CWE122_Heap_Based_Buffer_Overflow__c_CWE806_char_ncat_22_bad();
121    printLine("Finished bad()");
122#endif /* OMITBAD */
123    return 0;
124}
125
126#endif

  1/* TEMPLATE GENERATED TESTCASE FILE
  2Filename: CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_memmove_10.c
  3Label Definition File: CWE121_Stack_Based_Buffer_Overflow__CWE193.label.xml
  4Template File: sources-sink-10.tmpl.c
  5*/
  6/*
  7 * @description
  8 * CWE: 121 Stack Based Buffer Overflow
  9 * BadSource:  Point data to a buffer that does not have space for a NULL terminator
 10 * GoodSource: Point data to a buffer that includes space for a NULL terminator
 11 * Sink: memmove
 12 *    BadSink : Copy string to data using memmove()
 13 * Flow Variant: 10 Control flow: if(globalTrue) and if(globalFalse)
 14 *
 15 * */
 16
 17#include "std_testcase.h"
 18
 19#ifndef _WIN32
 20#include <wchar.h>
 21#endif
 22
 23/* MAINTENANCE NOTE: The length of this string should equal the 10 */
 24#define SRC_STRING "AAAAAAAAAA"
 25
 26#ifndef OMITBAD
 27
 28void CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_memmove_10_bad()
 29{
✓ 30    char * data;
✓ 31    char dataBadBuffer[10];
✓ 32    char dataGoodBuffer[10+1];
✓ 33    if(globalTrue)
 34    {
 35        /* FLAW: Set a pointer to a buffer that does not leave room for a NULL terminator when performing
 36         * string copies in the sinks  */
✓ 37        data = dataBadBuffer;
✓ 38        data[0] = '\0'; /* null terminate */
 39    }
 40    {
✓ 41        char source[10+1] = SRC_STRING;
 42        /* Copy length + 1 to include NUL terminator from source */
 43        /* POTENTIAL FLAW: data may not have enough space to hold source */
✓ 44        memmove(data, source, (strlen(source) + 1) * sizeof(char));❗VULN
✓ 45        printLine(data);
 46    }
 47}
 48
 49#endif /* OMITBAD */
 50
 51#ifndef OMITGOOD
 52
 53/* goodG2B1() - use goodsource and badsink by changing the globalTrue to globalFalse */
 54static void goodG2B1()
 55{
 56    char * data;
 57    char dataBadBuffer[10];
 58    char dataGoodBuffer[10+1];
 59    if(globalFalse)
 60    {
 61        /* INCIDENTAL: CWE 561 Dead Code, the code below will never run */
 62        printLine("Benign, fixed string");
 63    }
 64    else
 65    {
 66        /* FIX: Set a pointer to a buffer that leaves room for a NULL terminator when performing
 67         * string copies in the sinks  */
 68        data = dataGoodBuffer;
 69        data[0] = '\0'; /* null terminate */
 70    }
 71    {
 72        char source[10+1] = SRC_STRING;
 73        /* Copy length + 1 to include NUL terminator from source */
 74        /* POTENTIAL FLAW: data may not have enough space to hold source */
 75        memmove(data, source, (strlen(source) + 1) * sizeof(char));
 76        printLine(data);
 77    }
 78}
 79
 80/* goodG2B2() - use goodsource and badsink by reversing the blocks in the if statement */
 81static void goodG2B2()
 82{
 83    char * data;
 84    char dataBadBuffer[10];
 85    char dataGoodBuffer[10+1];
 86    if(globalTrue)
 87    {
 88        /* FIX: Set a pointer to a buffer that leaves room for a NULL terminator when performing
 89         * string copies in the sinks  */
 90        data = dataGoodBuffer;
 91        data[0] = '\0'; /* null terminate */
 92    }
 93    {
 94        char source[10+1] = SRC_STRING;
 95        /* Copy length + 1 to include NUL terminator from source */
 96        /* POTENTIAL FLAW: data may not have enough space to hold source */
 97        memmove(data, source, (strlen(source) + 1) * sizeof(char));
 98        printLine(data);
 99    }
100}
101
102void CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_memmove_10_good()
103{
104    goodG2B1();
105    goodG2B2();
106}
107
108#endif /* OMITGOOD */
109
110/* Below is the main(). It is only used when building this testcase on
111 * its own for testing or for building a binary to use in testing binary
112 * analysis tools. It is not used when compiling all the testcases as one
113 * application, which is how source code analysis tools are tested.
114 */
115
116#ifdef INCLUDEMAIN
117
118int main(int argc, char * argv[])
119{
120    /* seed randomness */
121    srand( (unsigned)time(NULL) );
122#ifndef OMITGOOD
123    printLine("Calling good()...");
124    CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_memmove_10_good();
125    printLine("Finished good()");
126#endif /* OMITGOOD */
127#ifndef OMITBAD
128    printLine("Calling bad()...");
129    CWE121_Stack_Based_Buffer_Overflow__CWE193_char_declare_memmove_10_bad();
130    printLine("Finished bad()");
131#endif /* OMITBAD */
132    return 0;
133}
134
135#endif